mindustry CLEAN: all 5 MOADs scanned, no defects found

defects/mindustry/CLEAN

@@ -0,0 +1,65 @@
+CLEAN — Mindustry (Anuken/Mindustry) — all 5 MOADs scanned 2026-03-31
+
+Repository: https://github.com/Anuken/Mindustry
+Version: HEAD (depth=1 clone)
+Stars: 24.6k
+Language: Java
+
+## MOAD-0001 (CWE-407): CLEAN
+
+Thorough scan of 817 Java source files across core/src/mindustry/.
+
+Mindustry uses Arc library data structures throughout. Key findings:
+
+- ObjectSet, IntSet, ObjectMap, ObjectIntMap used for all hot-path membership checks
+- PowerGraph.reflow() uses IntSet closedSet for BFS visited tracking
+- PayloadSeq uses ObjectIntMap internally (hash-based)
+- BlockIndexer uses QuadTree for spatial queries, IntSet for position tracking
+- Rules.objectiveFlags is ObjectSet<String>
+- Mods.ModResolutionContext uses ObjectSet for visited, OrderedSet for ordered
+- EntityGroup uses IntMap for entity ID mapping
+
+Seq.contains() calls found but all are:
+1. Predicate-based (lambda searching by property, not identity membership)
+2. On small fixed-size collections (weapons, plans, requirements, block flags)
+3. In non-hot paths (UI, connection-time, init, config changes)
+
+Administration.bannedIPs/whitelist/subnetBans are Seq<String> with contains()
+calls, but only checked per-connection (not per-tick). Typical N < 100.
+
+BlockIndexer.IntSeq.addUnique() for ore quadrants is O(N) but N is bounded
+by quadrant size (20x20 = 400 tiles max per quadrant per ore type).
+
+No O(N^2) patterns found in game-tick paths, entity update loops,
+pathfinding, power graph updates, or network sync code.
+
+## MOAD-0002 (Intertangle): NOTED but not patchable
+
+Vars.java is a classic god object with 40+ public static mutable fields
+(state, world, net, content, mods, renderer, ui, pathfinder, indexer,
+spawner, controlPath, fogControl, logic, control, player, etc.).
+
+Every subsystem accesses every other subsystem through these globals.
+This is a deliberate architectural choice common in game engines,
+especially modding-friendly ones. Fixing would require massive
+architectural refactoring, not a patch.
+
+## MOAD-0003 (Leaked Context): CLEAN
+
+ThreadLocal usage found in:
+- ArcNetProvider: decompression buffers (infrastructure, not request-scoped identity)
+- ModClassLoader.inChild: recursion guard Boolean
+
+No request-scoped identity leaked through ThreadLocal.
+
+## MOAD-0004 (Logged Secret): CLEAN
+
+No secrets (passwords, tokens, API keys) found in Log.info/warn/err calls.
+Network code does not log authentication headers or credentials.
+
+## MOAD-0005 (Thundering Herd): CLEAN
+
+Game is largely single-threaded (game loop on main thread).
+No cache get+miss+compute+put patterns without synchronization found.
+The synchronized block in ArcNetProvider.discoverServers is a simple
+lock for foundAddresses deduplication, not a thundering herd.